Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAn authoritative restore is not one universal command. To recover selected deleted users, computers, or groups, restore a suitable system state backup on a recovery domain controller and use Ntdsutil to mark the exact object or smallest required container as authoritative for replication. A domain-controller or forest disaster requires Microsoft’s separate forest-recovery sequence, including distinct AD DS and SYSVOL handling.
Choose the recovery procedure before running a command
The correct scope determines both the command and the risk of rolling back newer changes. Microsoft’s Active Directory Forest Recovery procedures cover forest-level recovery, while Microsoft’s guidance for restoring deleted accounts and groups covers selected objects.
As an Amazon Associate I earn from qualifying purchases.
| Recovery goal | Authoritative action | Scope and principal risk |
|---|---|---|
| One deleted object | Ntdsutil restore object |
Limits the rollback to that object and its restored attributes. |
| Several deleted objects in one container | Ntdsutil against their lowest common parent, or individual object restores | A parent restore affects every object and attribute in that container from the backup point. |
| An entire subtree | Ntdsutil restore subtree |
Can replace newer passwords, profile and home-directory paths, contact data, group membership, and security descriptors throughout the subtree. |
| One domain controller, a domain, or the forest | Microsoft forest-recovery workflow: nonauthoritative AD DS restore plus controlled SYSVOL recovery | Requires topology-specific sequencing; object-level Ntdsutil steps alone are insufficient. |
Prerequisites and safety checks
- Confirm that the backup contains system state data and is the most suitable recovery point. Microsoft states that a full-server backup intended only for full-server recovery does not qualify by itself for the documented system-state procedure.
- Use an AD-aware backup and restore method. Microsoft documents Windows Server Backup and
wbadminfor creating system-state backups in its system-state backup guidance. - Write down the exact distinguished name (DN) of the deleted object or container, including the domain components and organizational-unit path. A typo in the DN can target the wrong location or fail the operation.
- Identify the Windows Server version, backup method, domain and forest topology, and whether SYSVOL uses DFS Replication (DFSR) or legacy File Replication Service (FRS). Microsoft’s forest-recovery pages apply to Windows Server 2016, 2019, 2022, and 2025, but the matching version procedure controls the details.
- Decide whether you need one object, a group of objects, or a subtree. Select the narrowest scope that satisfies the recovery requirement, and record changes made after the backup date that may be overwritten.
Restore selected deleted objects with Ntdsutil
The documented sequence is: restore the latest suitable system-state backup to the designated recovery DC, perform the authoritative operation for the object or container, restart that DC in normal Active Directory mode, and allow the restored data to replicate outbound according to the applicable Microsoft procedure.
Restore one object
- Restore the system-state backup on the recovery domain controller using the procedure for your Windows Server version.
- Run Ntdsutil with the object’s complete DN. Microsoft’s command pattern is:
ntdsutil "authoritative restore" "restore object <object DN path>" q q
#1 Best Overall
Replace <object DN path> with the real DN and retain the quotation marks. The operation marks that object’s restored data as authoritative so it can replicate to its partners.
Restore several objects in one container
For multiple deleted objects, Microsoft recommends using the lowest common parent container that contains them. You may instead issue separate restore object operations when the parent contains unrelated objects whose newer changes must be preserved. The narrower approach takes more operations but reduces collateral rollback.
Restore a complete subtree
Use the subtree form only when every object and attribute in that scope should return to the backup point:
ntdsutil "authoritative restore" "restore subtree <container DN path>" q q
A subtree restore can remove legitimate changes made after the backup, including newer user passwords, home-directory and profile paths, contact information, group membership, and security descriptors. Review the container’s contents and change history before choosing this scope.
Complete the replication and membership work
After the Ntdsutil operation, restart the recovery DC in normal AD DS mode and follow the matching Microsoft recovery procedure for outbound replication and verification. Restored group or user membership can involve backlinks across domains; Microsoft documents Ntdsutil-generated object and LDIF files for cases that require that additional handling. Validate that the object exists with the expected attributes on the recovery DC and on the intended replication partners before returning the DC to ordinary service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use the forest-recovery workflow for a DC, domain, or forest disaster
Forest recovery is a coordinated process, not an expanded object restore. Microsoft’s nonauthoritative AD DS restore guidance describes restoring system state and provides the -authsysvol option for the controlled SYSVOL step. A documented command pattern is:
wbadmin start systemstaterecovery <otheroptions> -authsysvol
Supply the options required by the installed Windows Server version and the selected backup. Do not copy the placeholder literally, and do not use the command as a substitute for the complete forest-recovery plan.
Best Value
Authoritative SYSVOL is restricted to the first recovered DC
For the first recovered writable DC in the forest-root domain, Microsoft requires authoritative SYSVOL recovery so replication can restart from the selected new SYSVOL contents. The warning in AD Forest Recovery – Perform initial recovery states:
“Warning Perform an authoritative (or primary) restore operation of SYSVOL only for the first DC to be restored in the forest root domain. Incorrectly performing primary restore operations of the SYSVOL on other DCs leads to replication conflicts of SYSVOL data.”
Do not perform the primary or authoritative SYSVOL restore on subsequent domain controllers. Restore those DCs nonauthoritatively as directed by the forest-recovery sequence.
Recommended Free Tools
Follow the SYSVOL replication technology in use
Determine whether the forest uses DFSR or legacy FRS and select the corresponding Microsoft recovery path. The procedures are not interchangeable; Microsoft recommends migrating from FRS to DFSR. The first-DC SYSVOL rule remains a forest-recovery sequencing requirement, not a general instruction to make every DC authoritative.
Quick Recap
How to verify the result
- Confirm that the restored object or subtree is present on the recovery DC with the intended DN and attributes.
- Check that only the selected object, parent container, or subtree was restored; specifically review credentials, profile paths, memberships, contact fields, and security descriptors when the scope was broader than one object.
- Use the replication-verification steps in the matching Microsoft object-restore or forest-recovery procedure to confirm outbound replication to partners.
- For forest recovery, verify SYSVOL availability and replication after the first recovered DC establishes the authoritative SYSVOL state, then bring additional DCs back using their nonauthoritative steps.
- If the result is wrong, stop further replication, preserve the recovery evidence, and return to the version-specific Microsoft procedure rather than repeating an authoritative operation with a broader DN.
Official procedures to keep with the change record
- Restore user accounts and groups in AD — Ntdsutil object and subtree syntax, scope, and rollback effects.
- Perform a nonauthoritative restore of Active Directory Domain Services — system-state requirement and
-authsysvoloption (page metadata lists an update of 2024-11-01). - Back up the System State data — Windows Server Backup and
wbadminmethods. - authoritative restore — legacy command reference; use the current forest-recovery documentation for current deployments.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
